@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/src/shared/logger.contract.ts

@@ -0,0 +1,141 @@
+/**
+ * The contract for LOGGING. Nothing here writes anywhere — the one default
+ * implementation is the console sink in `shared/logging.ts`, and a deployment's
+ * shell installs whatever it runs in production (the server shell installs
+ * pino). Modules never import a sink; they ask for a tagged logger and log.
+ *
+ * WHY A PORT. The backend logged through 294 bare `console.*` calls with no
+ * level a filter could act on, no request or workspace a line could be
+ * grouped by, and no shape a machine could parse. When something fails at
+ * three in the morning the log cannot be reduced to one request or one
+ * severity. A library would have fixed that in the published package — and
+ * imposed a logging stack on every npm consumer, the enterprise overlay
+ * included, which very likely logs its own way already; two loggers
+ * interleaved is worse than either. So the package owns the contract and a
+ * dependency-free default, and the shell that actually runs owns the choice.
+ *
+ * WHAT A LINE CARRIES. A message, for a person; fields, for a machine; and
+ * the bindings of the logger it came from — at least `module`, the tag every
+ * call used to spell by hand in square brackets. Bindings and fields are one
+ * flat set on the line: a `child`'s bindings override its parent's under the
+ * same key, and a call's fields override the bindings — except `module`,
+ * which is the tag: the default sink fixes the `[tag]` from the logger's own
+ * bindings when it is made, and a call-time `module` is printed as an
+ * ordinary field beside it. Leave that key to the tag.
+ * An error goes under `err`, by that name: it is the key both the default
+ * sink and pino recognise as an error, and render with its stack. Put an
+ * `Error` there, not a string: the type cannot insist, and a string under
+ * `err` is logged as text — one line, escaped, but with no stack to show.
+ */
+
+export type LogFields = Record<string, unknown>;
+
+export interface ILogger {
+  debug(message: string, fields?: LogFields): void;
+  info(message: string, fields?: LogFields): void;
+  warn(message: string, fields?: LogFields): void;
+  error(message: string, fields?: LogFields): void;
+  /** A logger whose every line also carries `bindings`. */
+  child(bindings: LogFields): ILogger;
+}
+
+/**
+ * C0 and C1 control characters (U+009B among them: the one-byte CSI that
+ * starts an ANSI sequence by itself) and the JS line separators. The rule
+ * against control characters in a regex guards against accidental ones; these
+ * are the point.
+ */
+const CONTROL_CHARS = new RegExp(`[\x00-\x1F\x7F-\x9F${String.fromCharCode(0x2028, 0x2029)}]`, 'g');
+const NAMED: Record<string, string> = { '\n': '\\n', '\r': '\\r', '\t': '\\t' };
+
+/**
+ * `text` as one terminal-safe line. A message often carries text the process
+ * did not write — a branch name from a request, a path from a plugin, git's
+ * stderr — and written raw, a newline in it starts a forged line and an
+ * escape sequence paints the terminal. Every sink applies this, so the rule
+ * "one event, one line" is kept in one place rather than by each call site
+ * remembering `printable`. Shared with the shell's sink through this contract
+ * module because pino's JSON escapes only the C0 range: a C1 control or a
+ * line separator would pass through it to the terminal that tails the log.
+ */
+export function oneLine(text: string): string {
+  return text.replace(CONTROL_CHARS, (c) => NAMED[c] ?? `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+
+/**
+ * `err` with the text it carries made terminal-safe, its frames untouched.
+ *
+ * An error's message is very often not the process's own words: it quotes a
+ * path, a branch name, git's stderr, a file's contents. Its stack frames ARE
+ * the process's own and read best as the lines they are, so only the
+ * message — and the head of the stack, which repeats it — is escaped. A
+ * `cause` that is itself an error is treated the same way, since the console
+ * prints it too (a chain that loops back on itself is cut where it loops).
+ * The original is never mutated: an error is often rethrown or inspected
+ * after it was logged.
+ */
+export function oneLineError(err: Error): Error {
+  return escapedCopy(err, new Set());
+}
+
+function escapedCopy(err: Error, seen: Set<Error>): Error {
+  seen.add(err);
+  const message = oneLine(err.message);
+  const copy = Object.create(Object.getPrototypeOf(err) as object) as Error & { cause?: unknown };
+  Object.defineProperty(copy, 'message', { value: message, enumerable: false, writable: true, configurable: true });
+  Object.defineProperty(copy, 'name', { value: err.name, enumerable: false, writable: true, configurable: true });
+  if (typeof err.stack === 'string') {
+    // Node's stack is the error's own `toString()` — `<name>: <message>` —
+    // followed by `\n    at …` frames. The frames are looked for AFTER that
+    // header, not from the top: a message that itself holds a line shaped
+    // like a frame would otherwise move the boundary up and pass the rest of
+    // itself through raw. A stack that does not open with the header is not
+    // one this code knows the shape of, and is escaped whole.
+    // The frames keep their lines; each is still escaped within its line, for
+    // a stack that is not Node's own (a foreign runtime's, a hand-built one)
+    // and carries a control character after a frame-shaped line.
+    const head = Error.prototype.toString.call(err);
+    const frames = err.stack.startsWith(head) ? err.stack.indexOf('\n    at ', head.length) : -1;
+    const stack =
+      frames === -1
+        ? oneLine(err.stack)
+        : `${oneLine(err.stack.slice(0, frames))}\n${err.stack
+            .slice(frames + 1)
+            .split('\n')
+            .map(oneLine)
+            .join('\n')}`;
+    Object.defineProperty(copy, 'stack', { value: stack, enumerable: false, writable: true, configurable: true });
+  }
+  const nested = (value: unknown): unknown =>
+    value instanceof Error
+      ? seen.has(value)
+        ? '[circular]'
+        : escapedCopy(value, seen)
+      : typeof value === 'string'
+        ? oneLine(value)
+        : value;
+  const cause = (err as { cause?: unknown }).cause;
+  if (cause !== undefined) {
+    Object.defineProperty(copy, 'cause', { value: nested(cause), enumerable: false, writable: true, configurable: true });
+  }
+  // An `AggregateError`'s failures — non-enumerable there, and the whole
+  // point of it; kept as enumerable as the source had it, so an ordinary
+  // error that carries an `errors` list of its own still shows it.
+  const errors = (err as { errors?: unknown }).errors;
+  if (Array.isArray(errors)) {
+    Object.defineProperty(copy, 'errors', {
+      value: errors.map(nested),
+      enumerable: Object.prototype.propertyIsEnumerable.call(err, 'errors'),
+      writable: true,
+      configurable: true,
+    });
+  }
+  // Own enumerable fields (a `code`, a `status`) travel with the error.
+  for (const [key, value] of Object.entries(err)) {
+    if (!(key in copy)) (copy as unknown as Record<string, unknown>)[key] = typeof value === 'string' ? oneLine(value) : value;
+  }
+  // `seen` is the path down, not everything met: one failure listed twice
+  // under an AggregateError is copied twice, and only a true loop is cut.
+  seen.delete(err);
+  return copy;
+}

package/src/shared/logging.ts

@@ -0,0 +1,96 @@
+// This file IS the console sink; every other file logs through it. The lint
+// rule that forbids `console` elsewhere in the backend exempts exactly this
+// file (see eslint.config.js).
+import { oneLine, oneLineError, type ILogger, type LogFields } from './logger.contract.js';
+
+/**
+ * Where the backend's logging goes, and how a module gets a logger.
+ *
+ * ONE SLOT, INSTALLED ONCE. The composition root — or a shell before it —
+ * calls {@link setLogger} with the implementation the process runs on, and
+ * every module obtains a tagged child through {@link logger}. The slot is
+ * process-wide on purpose: the `console` it replaces was, and threading a
+ * logger through some sixty constructors (and the several hundred places
+ * tests construct them) would spend a great deal to make a cross-cutting
+ * concern look like a per-object dependency. It remains injectable: a suite
+ * that wants to see what was logged installs a capturing logger through the
+ * same setter.
+ *
+ * CHILDREN RESOLVE LATE. `logger('tag')` is called at module load, before any
+ * root has run, so what it returns is a handle that looks the slot up on
+ * every call rather than a child of whatever happened to be installed then.
+ * Installing pino after a module loaded therefore still routes that module's
+ * lines through pino.
+ */
+
+let current: ILogger = createConsoleLogger();
+
+/** Install the process's logger. Returns the previous one, for a suite to restore. */
+export function setLogger(impl: ILogger): ILogger {
+  const previous = current;
+  current = impl;
+  return previous;
+}
+
+/**
+ * The logger a module logs through, carrying `module: tag` on every line — the
+ * `[tag]` every call used to spell by hand.
+ */
+export function logger(tag: string): ILogger {
+  return lateBound({ module: tag });
+}
+
+function lateBound(bindings: LogFields): ILogger {
+  return {
+    debug: (message, fields) => current.child(bindings).debug(message, fields),
+    info: (message, fields) => current.child(bindings).info(message, fields),
+    warn: (message, fields) => current.child(bindings).warn(message, fields),
+    error: (message, fields) => current.child(bindings).error(message, fields),
+    child: (more) => lateBound({ ...bindings, ...more }),
+  };
+}
+
+/**
+ * The default sink: `console`, in the shape the backend has always written —
+ * `[module] message`, and the fields after it. Dependency-free, so the
+ * published package logs sensibly with nothing installed, and human-shaped,
+ * because a terminal is where that case is read. A deployment that wants
+ * machine-shaped lines installs a sink that emits them; the server shell
+ * installs pino.
+ *
+ * Fields are passed to `console` as a second argument rather than folded into
+ * the string, so an object stays inspectable and an error keeps its stack.
+ * When `err` is the only field it is passed bare: that is the shape a person
+ * at a terminal wants, and the shape the suites that watch the console have
+ * always asserted on.
+ *
+ * An error field is passed as a copy whose message is one line (see
+ * `oneLineError`): the stack the console prints is the process's own text,
+ * but the message at its head is very often not — it quotes git's stderr, a
+ * path, a request's branch name — and unescaped it would forge a line or
+ * paint the terminal exactly as a string field would. Every call site that
+ * logs `{ err }` is covered here, so none of them has to remember it.
+ */
+export function createConsoleLogger(bindings: LogFields = {}): ILogger {
+  // The tag is a binding like any other and goes through the same rule: a
+  // module name is the code's own today, but the contract lets a caller bind
+  // one, and a tag is written at the head of every line it tags.
+  const prefix = typeof bindings.module === 'string' ? `[${oneLine(bindings.module)}] ` : '';
+  const rest = Object.fromEntries(Object.entries(bindings).filter(([k]) => k !== 'module'));
+  const safe = (v: unknown): unknown => (typeof v === 'string' ? oneLine(v) : v instanceof Error ? oneLineError(v) : v);
+  const extra = (fields: LogFields | undefined): unknown[] => {
+    const merged = Object.fromEntries(Object.entries({ ...rest, ...fields }).map(([k, v]) => [k, safe(v)]));
+    const keys = Object.keys(merged);
+    if (keys.length === 0) return [];
+    if (keys.length === 1 && keys[0] === 'err') return [merged.err];
+    return [merged];
+  };
+  return {
+    debug: (message, fields) => console.debug(`${prefix}${oneLine(message)}`, ...extra(fields)),
+    info: (message, fields) => console.log(`${prefix}${oneLine(message)}`, ...extra(fields)),
+    warn: (message, fields) => console.warn(`${prefix}${oneLine(message)}`, ...extra(fields)),
+    error: (message, fields) => console.error(`${prefix}${oneLine(message)}`, ...extra(fields)),
+    child: (more) => createConsoleLogger({ ...bindings, ...more }),
+  };
+}
+

package/src/shared/path-containment.ts

@@ -0,0 +1,34 @@
+import path from 'node:path';
+import { PathTraversalError } from './domain-errors.js';
+
+/**
+ * THE containment check for ABSOLUTE paths: is `absolutePath` the directory
+ * `dir`, or something under it?
+ *
+ * Three surfaces carried a copy of this — the workspace service, the diff
+ * ledger and the delete route — and each threw a bare `Error` whose MESSAGE
+ * five catch sites then matched to decide on a 403. A reworded message would
+ * have turned every one of those into a 500, which is to say into a silently
+ * unblocked traversal in the log. So the refusal is a TYPE now
+ * ({@link PathTraversalError}, 403 with a `path-traversal` payload), and the
+ * route layers read the status off the class like every other domain error.
+ *
+ * LEXICAL, deliberately: it compares resolved spellings and follows no links,
+ * so it is safe to call before anything touches the disk. It is therefore not
+ * the whole rule — a path may be contained by its spelling and still reach
+ * outside through a symlink, which is `assertNotThroughLink`'s job, and a
+ * workspace-RELATIVE spelling is `canonicalFileIdentity`'s. This is the first
+ * of those three, and the only one every caller needs.
+ */
+export function assertWithinDirectory(absolutePath: string, dir: string): void {
+  const resolved = path.resolve(absolutePath);
+  const root = path.resolve(dir);
+  // The separator is what makes this a containment check rather than a prefix
+  // match — without it `/srv/ws-backup` passes as "inside" `/srv/ws`. A root
+  // that already ends in one (the filesystem root, `/` or `C:\`) must not get
+  // a second, or every descendant fails to match the doubled prefix.
+  const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+  if (resolved !== root && !resolved.startsWith(prefix)) {
+    throw new PathTraversalError();
+  }
+}

package/src/shared/pending-proposals.ts

@@ -0,0 +1,161 @@
+import { DEFAULT_BRANCH, type ChangeRequest, type IWorkflowService } from '@bevel-software/platform-shared';
+import type { WorkspaceService } from '../modules/workspace/workspace.service.js';
+import { workspaceIdForBranch } from './workspace-id.js';
+import type { IAccessControl } from '../modules/access/access-control.interface.js';
+import { canonicalEmail, hashEmail } from './email-identity.js';
+import { printable } from './printable.js';
+import { logger } from './logging.js';
+
+const log = logger('pending-proposals');
+
+/**
+ * The mechanics every "proposed, not released" surface shares.
+ *
+ * Skills and tools both have a half of their catalog that is NOT on the default
+ * branch: a change request that ADDS a declaration has nothing on the default
+ * branch to hang itself off, so until it merged the proposal was invisible to
+ * its author and to the people who had to approve it. Both surfaces answer that
+ * the same way — walk the OPEN change requests, keep the touched paths that
+ * look like the declaration in question, decide who may see each one, and read
+ * the file at the request's own branch — and only the "looks like" predicate and
+ * the parsing differ.
+ *
+ * Kept in one place so the two cannot drift on the part that matters most: WHO
+ * MAY SEE A PROPOSAL. It is narrower than who may see the catalog — the author,
+ * and whoever could approve it. "Could approve it" is not re-stated as an
+ * admin check; it is `canWrite` on the very path the request would create,
+ * resolved on the DEFAULT branch. The new file carries no `access.md` of its
+ * own, so that verdict inherits from the plugin folder, which IS the plugin's
+ * admin; asking the access tree keeps these surfaces and the merge gate
+ * answering with one voice. The branch's own copy of the tree is written by the
+ * proposer and must not get a say in who reviews them.
+ */
+export interface ProposalSources {
+  workspaceService: Pick<WorkspaceService, 'ensureRemotesFetched' | 'readFileAtRef'>;
+  accessControl: Pick<IAccessControl, 'canWriteBatch'>;
+  workflow: Pick<IWorkflowService, 'listChangeRequests'>;
+}
+
+/** One file an open change request proposes, already read at that request's branch. */
+export interface ProposedFile {
+  /** The open change request that would release it. */
+  cr: ChangeRequest;
+  /** Repo-root-relative path of the proposed file. */
+  path: string;
+  /** The file's content at the request's branch. */
+  content: string;
+  /** True when the caller opened the request themselves. */
+  isAuthor: boolean;
+}
+
+/**
+ * Every file matching `matches` that an OPEN change request proposes and this
+ * caller is entitled to see, with its branch content in hand.
+ *
+ * Never throws: these surfaces hang off the library's list load, and a review
+ * shelf that cannot answer must not take the shelf down with it. Everything
+ * degrades to "nothing pending".
+ *
+ * `matches` is where a surface states what it is looking for — and, because it
+ * runs BEFORE the access batch, also where it drops what it already serves from
+ * the default branch, so the batch stays as small as the answer.
+ *
+ * Order follows the change requests as the workflow service listed them; a
+ * caller that wants a stable reading order sorts the result itself.
+ */
+export async function visibleProposedFiles(
+  sources: ProposalSources,
+  userEmail: string,
+  matches: (repoRelPath: string) => boolean,
+): Promise<ProposedFile[]> {
+  const email = canonicalEmail(userEmail);
+  if (!email) return [];
+
+  let crs: ChangeRequest[];
+  try {
+    // Open, and aimed at the DEFAULT BRANCH. Everything downstream is written
+    // in terms of that branch — the released set that decides "added", and the
+    // access tree that decides who may review — so a request targeting some
+    // other branch is not a proposal these surfaces can speak about: merging it
+    // puts nothing in the catalog, and the card would never resolve.
+    crs = (await sources.workflow.listChangeRequests()).filter(
+      (c) => c.state === 'open' && c.base === DEFAULT_BRANCH,
+    );
+  } catch {
+    return [];
+  }
+  if (crs.length === 0) return [];
+
+  const candidates = crs.flatMap((cr) =>
+    cr.touchedNodePaths.filter(matches).map((path) => ({ cr, path })),
+  );
+  if (candidates.length === 0) return [];
+
+  const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+  const authorHash = hashEmail(email);
+
+  // One access load for every candidate, resolved on the DEFAULT branch — see
+  // the note on {@link ProposalSources}.
+  const writable = await sources.accessControl
+    .canWriteBatch(
+      wsId,
+      email,
+      candidates.map((c) => c.path),
+    )
+    .catch(() => new Map<string, boolean>());
+
+  // The branch copies are read through the default branch's clone at
+  // `origin/<branch>`, so a proposal never needs a clone of its own. Refresh
+  // first, best-effort: a request pushed seconds ago is worth one fetch, and a
+  // failed fetch should degrade to "read what we have".
+  await sources.workspaceService.ensureRemotesFetched(wsId).catch(() => undefined);
+
+  const out: ProposedFile[] = [];
+  for (const { cr, path } of candidates) {
+    const isAuthor = !!cr.authorId && cr.authorId === authorHash;
+    // Fail closed, matching the catalog: only an explicit `true` admits a
+    // reviewer. A missing entry (the batch skipped the path, the tree could not
+    // be read) means denied, never shown.
+    if (!isAuthor && writable.get(path) !== true) continue;
+
+    const content = await readAt(sources.workspaceService, wsId, cr.branch, path);
+    // Nothing to describe: the request touched the path but the file is gone at
+    // its head (proposed then withdrawn within the branch), or unreadable.
+    if (content === null) continue;
+    out.push({ cr, path, content, isAuthor });
+  }
+  return out;
+}
+
+/**
+ * The file at a branch, or null when it is not there.
+ *
+ * `readFileAtRef` ALREADY answers `null` for genuine absence (a `git show` that
+ * finds no such blob), so everything reaching the catch below is an infra
+ * failure instead — an unresolvable workspace, a rejected ref, a git call that
+ * timed out. The contract of this module is "never throws", so those still
+ * become `null` and the card still drops; what they must not do is drop
+ * SILENTLY, which is how a fetch problem reads as "the proposer withdrew it".
+ * The warning is the difference between a shelf that degraded and a shelf that
+ * lied.
+ */
+export async function readAt(
+  workspaceService: Pick<WorkspaceService, 'readFileAtRef'>,
+  wsId: string,
+  branch: string,
+  repoRelPath: string,
+): Promise<string | null> {
+  try {
+    return await workspaceService.readFileAtRef(wsId, `origin/${branch}`, repoRelPath);
+  } catch (err) {
+    // Every interpolated value is attacker-shaped: the path and the branch come
+    // off a change request somebody else opened, and the reason comes off git.
+    // A raw newline or an escape sequence in any of them forges a log line or
+    // steers the operator's terminal, so all three go through `printable`.
+    log.warn(
+      `could not read ${printable(repoRelPath)} at origin/${printable(branch)} in ${printable(wsId)}; ` +
+        `dropping it from the review shelf: ${printable(err instanceof Error ? err.message : String(err))}`,
+    );
+    return null;
+  }
+}

package/src/shared/printable.ts

@@ -0,0 +1,68 @@
+/**
+ * Re-export, so this backend's ~20 call sites keep their short import while
+ * the function itself lives where BOTH MCP surfaces can reach it.
+ *
+ * The local server (`@bevel-software/hexis-mcp`) is published standalone and
+ * cannot import this package, but it logs the same kind of text — a reason
+ * string that came off the network — to the same kind of operator log. Two
+ * copies of an escaper is two escapers that drift, so it moved to the one
+ * package both already depend on. See `printable` there for what it escapes
+ * and why.
+ */
+export { printable } from '@bevel-software/platform-mcp-core';
+
+/**
+ * A path (or any short text) as it may be interpolated into a ONE-LINE
+ * message: every character a caller can put in a filename that RENDERS as a
+ * line break is escaped, so a refusal naming the path stays one line and
+ * cannot forge a second.
+ *
+ * That is every C0 and C1 control character — CR and LF, the other mandatory
+ * breaks (vertical tab, form feed, NEL), and the one-byte escapes a terminal
+ * obeys (U+009B starts an ANSI sequence on its own) — and the Unicode line
+ * separators U+2028/U+2029 with them: `JSON.stringify` leaves the C1 range
+ * and the separators raw, so a path that carries one survives being carried
+ * — in the `path` field of a not-found body, in a log line — and breaks or
+ * steers the line wherever it is finally rendered. {@link printable} escapes
+ * the same set for exactly that reason; the spelling is the same too (`\n`,
+ * `\t`, else `\uXXXX`), so a path reads alike in a refusal and in a log.
+ *
+ * Unquoted, unlike {@link printable}: this text is read by a person or an
+ * agent inside a sentence that already quotes it, not by an operator scanning
+ * a log. THE spelling for that job — `displayPath` in the file readers is this
+ * function, and the missing-path refusals use it too, so a path reads the same
+ * however it is refused.
+ */
+// The names JSON gives its escapes — and so what `printable`, which is
+// `JSON.stringify` underneath, writes for the same characters; every other
+// control is `\uXXXX` in both, so a path reads the same in a refusal and
+// in a log. (JSON has no name for vertical tab, so neither does this.)
+const NAMED_ESCAPES: ReadonlyMap<string, string> = new Map([
+  ['\b', '\\b'],
+  ['\t', '\\t'],
+  ['\n', '\\n'],
+  ['\f', '\\f'],
+  ['\r', '\\r'],
+]);
+// Built rather than written: the lint rule against control characters in a
+// regex literal guards against accidental ones, and these are the point.
+const CONTROL_OR_SEPARATOR = new RegExp(`[\\x00-\\x1F\\x7F-\\x9F${String.fromCharCode(0x2028, 0x2029)}]`, 'g');
+/** The characters `JSON.stringify` leaves raw: the C1 range and the two line separators. */
+const RAW_AFTER_JSON = new RegExp(`[\\x7F-\\x9F${String.fromCharCode(0x2028, 0x2029)}]`, 'g');
+
+const uEscape = (c: string): string => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`;
+
+export function sanitizedPath(text: string): string {
+  return text.replace(CONTROL_OR_SEPARATOR, (c) => NAMED_ESCAPES.get(c) ?? uEscape(c));
+}
+
+/**
+ * JSON text as a terminal can show it: `JSON.stringify` escapes the C0
+ * controls inside strings and leaves the C1 range and the line separators
+ * raw, so those are escaped here — still the same JSON to any reader of it,
+ * since they can only occur inside a string. For a document, not a path:
+ * the JSON's own line breaks (pretty-printing) are left alone.
+ */
+export function terminalSafeJson(json: string): string {
+  return json.replace(RAW_AFTER_JSON, uEscape);
+}

package/src/shared/redact-secret.ts

@@ -0,0 +1,118 @@
+/**
+ * Scrub credentials from anything that reaches a log or an error message:
+ * the token in effect wherever it appears, URL userinfo — a remote spelled
+ * `https://user:pass@host` would otherwise leak `pass` verbatim through every
+ * git failure that quotes the URL back — and URL query strings, where a
+ * presigned remote keeps its credential.
+ *
+ * "The token in effect" is every place one can come from: each environment
+ * spelling `CoreConfig` accepts (it normalises them onto `GITHUB_TOKEN` at
+ * boot, but a later write to one of them is not normalised), plus whatever the
+ * caller knows about — the settings-stored token, a token a request brought
+ * along, or a remote's query values ({@link urlQuerySecrets}). Longest first,
+ * so a secret that contains another is not half-scrubbed.
+ *
+ * Shared, not a module's own: the KB startup phase and the setup routes both
+ * log git's words, and one scrub is the only way they cannot disagree about
+ * what a secret is.
+ */
+export function redactSecret(text: string, secrets: readonly (string | null | undefined)[] = []): string {
+  const tokens = [
+    process.env.GITHUB_TOKEN,
+    process.env.GIT_TOKEN,
+    process.env.GH_TOKEN,
+    ...secrets,
+  ]
+    .map((t) => t?.trim())
+    .filter((t): t is string => !!t);
+  let scrubbed = text;
+  const ordered = [...new Set(tokens)].sort((a, b) => b.length - a.length);
+  // Every whole value first, then every echoed PREFIX. Git and the providers
+  // elide the middle of a token they quote back (`ghp_abcdef…`), and an exact
+  // match would leave that head on screen — enough of a secret to be one.
+  // Both can be in one text (the value in a URL, the elided form in the
+  // host's reply), so the prefix pass runs whether or not the whole was
+  // found — but only once every whole value is gone, or the head two tokens
+  // share (`ghp_from…`) would garble the second before its own turn came.
+  // Down to a floor, so a short common head (`ghp_`) does not garble every
+  // other token in the log.
+  for (const token of ordered) scrubbed = scrubbed.replaceAll(token, '***');
+  // Every echoed prefix of every token, LONGEST FIRST ACROSS TOKENS — not
+  // token by token: two tokens can share a head longer than the floor
+  // (`ghp_abcdefgh…`), and one token's shorter prefix, taken first, would
+  // scrub that head out of the other's echo and leave the rest of it on
+  // screen (`***Y123…`). Longest first, the longer echo goes whole.
+  const prefixes = ordered.flatMap((token) =>
+    Array.from({ length: Math.max(0, token.length - MIN_ECHOED_PREFIX_LENGTH) }, (_, i) => token.slice(0, token.length - 1 - i)),
+  );
+  for (const prefix of [...new Set(prefixes)].sort((a, b) => b.length - a.length)) {
+    if (scrubbed.includes(prefix)) scrubbed = scrubbed.replaceAll(prefix, '***');
+  }
+  return (
+    scrubbed
+      // Through the LAST `@` before the path: a password can carry an
+      // unencoded `@` of its own (`https://user:p@ss@host`), and stopping at
+      // the first would leave the rest of it in the log.
+      .replace(/:\/\/[^/\s]*@/g, '://***@')
+      // A presigned remote carries its credential in the query instead
+      // (`?X-Amz-Signature=…`, `?access_token=…`). A git remote has no query
+      // worth keeping in a log, so the whole of it goes — up to whitespace or
+      // a fragment, not to the first quote: a credential can carry a quote
+      // of its own, and stopping there would leave the rest of it in the log.
+      // When git quoted the URL, the LAST quote of that kind before the next
+      // space is the one closing it, and what follows it (`': 403`) is kept.
+      .replace(
+        /(\bhttps?:\/\/[^\s?#'"]+)\?([^\s#]*)/gi,
+        (_m, url: string, query: string, offset: number, whole: string) => {
+          const opener = whole[offset - 1];
+          const closing = opener === "'" || opener === '"' ? query.lastIndexOf(opener) : -1;
+          return `${url}?***${closing === -1 ? '' : query.slice(closing)}`;
+        },
+      )
+  );
+}
+
+/** Shorter than this, a query value is not a credential (`X-Amz-Expires=3600`). */
+const MIN_SECRET_LENGTH = 8;
+
+/**
+ * The shortest head of a token that is still scrubbed when only a prefix of
+ * it was echoed — the same floor the connection probe's redactor uses. Below
+ * it a head is a vendor's common prefix, not a secret.
+ */
+const MIN_ECHOED_PREFIX_LENGTH = 8;
+
+/**
+ * A remote's query, named as literal secrets for {@link redactSecret}: the
+ * query as written and each value in it, raw and percent-decoded.
+ *
+ * `redactSecret` drops a query that FOLLOWS a URL. Naming the values as well
+ * scrubs them wherever else they turn up — decoded, or on their own — where no
+ * URL pattern can see them. Values too short to be a credential are left alone,
+ * so a `3600` in the query does not garble every number in the log.
+ */
+export function urlQuerySecrets(url: string | null | undefined): string[] {
+  let query: string;
+  try {
+    query = url ? new URL(url.trim()).search.slice(1) : '';
+  } catch {
+    return [];
+  }
+  const secrets = new Set<string>();
+  if (query.length >= MIN_SECRET_LENGTH) secrets.add(query);
+  for (const part of query.split('&')) {
+    const raw = part.slice(part.indexOf('=') + 1);
+    for (const value of [raw, decoded(raw)]) {
+      if (value.length >= MIN_SECRET_LENGTH) secrets.add(value);
+    }
+  }
+  return [...secrets];
+}
+
+function decoded(value: string): string {
+  try {
+    return decodeURIComponent(value.replace(/\+/g, ' '));
+  } catch {
+    return value;
+  }
+}